Privacy notice

Effective October 26, 2026

Account authentication

We verify Google token signatures, issuer, audience and expiry on the server. Email and real name are not stored in member records or session cookies. We never receive your password. A hashed identifier distinguishes accounts.

Public information

Nicknames, public photos, titles, descriptions, posts, comments, levels and medals are visible to everyone. Car photos are published after duplicate checks; rare-plate photos await moderation. Do not post private information or photos you do not have permission to share.

Original photos and location

Originals and their metadata are private to the author and authorized administrators. Public photos have EXIF removed. We read capture time and GPS to identify a city using offline boundary data, without sending GPS to an external location service. You can correct the time or city or hide the location. New uploads and edits share only a city center. Legacy plate-map coordinates are rounded to one decimal place.

Plate reading and AI captions

Plate OCR runs in your browser without sending photos to an external OCR server. When AI captions are enabled, clicking the button sends the masked public preview to OpenAI. EXIF is stripped on the server; the original file, GPS and account name are not included. Suggestions are editable and never auto-published. Per-user and total request limits apply.

Sessions and request protection

Session cookies use Secure, HttpOnly and SameSite protections. Sessions last up to 7 days; sign-in challenges up to 10 minutes. Rate limiting may store a minute-specific anonymous hash with a short expiry; raw IP addresses are not stored in this rate-limit table.

Deletion and retained records

You can delete your photos, posts and comments. Photo deletion removes its public content and stored image objects and reverses its XP. Duplicate-detection hashes, moderation records, finalized votes and medals may remain. Self-service account deletion is not yet available.

Service providers

Hosting and storage use OpenAI Sites and its underlying Cloudflare services. Sign-in uses Google Identity Services. News headlines are fetched by language from fixed automotive publications and official newsroom RSS feeds; opening a story visits its source. City-map outlines use public-domain Natural Earth data; offline location lookup uses geoBoundaries/citypopulation.de boundaries (CC BY 3.0), without external map tiles.